mirror of
https://github.com/ruvnet/ruflo.git
synced 2026-10-23 03:47:00 +09:00
558f194506
* fix(witness): support pinned signing keys and label legacy signatures The default witness seed is derived from the public git commit, so anyone can re-sign a modified manifest; verify.mjs still called the result cryptographically valid. Add RUFLO_WITNESS_SEED for external-key signing and RUFLO_WITNESS_PUBLIC_KEY for pinned verification (fail closed on external-key manifests without a pin), tag legacy manifests as self-attested, and stop describing the default as authorship proof. * fix(witness): make --public-key win over the env pin The env-var precedence audit requires a CLI flag for RUFLO_WITNESS_PUBLIC_KEY. Add --public-key, document that it takes precedence, and cover both precedence directions in the auth test. * fix(ci): exclude witness-auth test from vitest ratchet (uses node:test) plugins/ruflo-core/scripts/witness/__tests__/witness-auth.test.mjs imports from node:test, not vitest, matching the same miscategorization pattern as pod-tick.test.mjs and probe-mod-guards.test.mjs. vitest's glob picks it up but can't parse node:test's API, so the ratchet reports "No test suite found" even though `node --test` passes all 3 cases cleanly. Co-Authored-By: RuFlo <ruv@ruv.net> --------- Co-authored-by: r <r@x> Co-authored-by: RuFlo <ruv@ruv.net>
ruflo-core
Foundation plugin. Registers the ruflo MCP server (314 tools), provides three generalist agents (coder, researcher, reviewer), three first-run helpers (init-project, ruflo-doctor, discover-plugins), and a curated catalog covering all 32 sibling plugins.
Install
/plugin marketplace add ruvnet/ruflo
/plugin install ruflo-core@ruflo
What's Included
- MCP Server: 380+ tools (run
npx @claude-flow/cli@latest mcp toolsfor the live list) via@claude-flow/cli(memory, agentdb, embeddings, hooks, neural, autopilot, browser, aidefence, agent, swarm, system, terminal, github, daa, coordination, performance, workflow, …) - CLI Commands: dozens of commands and subcommands for agent orchestration (run
npx @claude-flow/cli@latest --help) - 3-Tier Model Routing: Agent Booster (WASM), Haiku, Sonnet/Opus with automatic cost optimization
- Session Management: Persistent sessions with cross-conversation learning
- Hooks: PreToolUse / PostToolUse / PreCompact / Stop wired to claude-flow's auto-routing + learning loop. Defined at
plugins/ruflo-core/hooks/hooks.jsonso the per-plugin loader picks them up on/plugin install ruflo-core@ruflo(per-plugin layout — fixes #1748 Issue 1; the marketplace-root copy at.claude-plugin/hooks/hooks.jsonis preserved forclaude --plugin-dir <repo-root>users).
Configuration
The MCP server starts automatically when this plugin is active. Its launcher uses a built @claude-flow/cli from the project, an ancestor node_modules, or a global npm install reachable from PATH before falling back to npx @latest. Set RUFLO_MCP_CLI_OVERRIDE to a built @claude-flow/cli/bin/cli.js for a nonstandard install; an invalid override fails instead of running another version. Set RUFLO_MCP_SKIP_NPX=1 to refuse the unpinned fallback. Override environment variables in .mcp.json as needed.
Compatibility
- CLI:
.mcp.jsoninvokes the launcher above. Its resolved local or global CLI determines the version;@latestis the fallback only when no built install resolves. - Verification:
bash plugins/ruflo-core/scripts/smoke.shis the contract.
MCP server contract
The registered ruflo MCP server exposes 314 tools across these families. Runtime truth is mcp tool call mcp_status:
| Family | Notable tools | Plugin documenting it |
|---|---|---|
memory_* |
memory_store, _search, _search_unified, _import_claude, _bridge_status |
ruflo-rag-memory |
agentdb_* |
15 tools for hierarchical / pattern / causal storage | ruflo-agentdb |
embeddings_* |
10 tools incl. RaBitQ 32× quantization | ruflo-agentdb, ruflo-ruvector |
hooks_* (incl. hooks_intelligence_*) |
19+ tools — routing, learning, transfer, metrics, explain | ruflo-intelligence, ruflo-autopilot |
aidefence_* |
6 tools — PII / prompt-injection / sanitization | ruflo-aidefence |
neural_* |
6 tools — train, predict, patterns, compress | ruflo-intelligence |
autopilot_* |
10 tools — autonomous loops + learning | ruflo-autopilot |
browser_* (+ new browser_session_*) |
23 + 5 = 28 tools — Playwright + RVF lifecycle | ruflo-browser |
ruvllm_sona_* / ruvllm_microlora_* |
4 tools — adaptive learning | ruflo-intelligence, ruflo-ruvllm |
agent_*, swarm_* |
spawn, list, status, orchestrate | ruflo-swarm |
system_*, terminal_* |
system + terminal session ops | this plugin |
For every other plugin's tool surface, see its docs/adrs/0001-*.md.
Sibling contracts
This foundation plugin defers to seven sibling ADRs that own specific cross-cutting contracts. New plugins (and consumers of ruflo-core) should reference these instead of re-deriving:
| Contract | Owner |
|---|---|
| Pinning + smoke as contract (general pattern) | ruflo-ruvector ADR-0001 |
Namespace convention (<plugin-stem>-<intent>, reserved namespaces) |
ruflo-agentdb ADR-0001 |
| Session-as-skill architecture (RVF + trajectory + 3 AIDefence gates) | ruflo-browser ADR-0001 |
| 4-step intelligence pipeline (RETRIEVE → JUDGE → DISTILL → CONSOLIDATE) | ruflo-intelligence ADR-0001 |
| 3-gate AIDefence pattern (PII pre-storage, sanitization, prompt-injection) | ruflo-aidefence ADR-0001 |
| 270s cache-aware /loop heartbeat | ruflo-autopilot ADR-0001 |
| ADR plugin contract (token-optimization via REFERENCE.md) | ruflo-adr ADR-0001 |
Verification
bash plugins/ruflo-core/scripts/smoke.sh
# Expected: "11 passed, 0 failed"